GDPR for Small Businesses: Requirements, Exemptions, and Checklist

Reviewed September 28, 2026. The GDPR can apply to a small business, a sole trader, or a company outside Europe. Business size is not the main scope test. What matters is where the business is established, whose personal data it processes, why it processes that data, and whether it offers goods or services to people in the European Union or monitors their behavior there.

A website that can merely be viewed from the EU does not automatically put a non EU business within GDPR scope. The European Commission's scope guidance says there must be additional evidence of offering goods or services to people in the EU, or monitoring their behavior there. An EU establishment can also bring processing within scope when the processing occurs in the context of that establishment's activities.

This guide explains the requirements, the limited small business exemptions, and a practical compliance checklist. It is designed for owners who need an operational starting point, not a claim that every small business has identical duties.

GDPR checklist for a small business

Use this checklist to find the gaps that matter first:

1. Confirm scope. Record the facts connecting the business and each processing activity to the EU or European Economic Area.
2. Map personal data. List what you collect, where it comes from, why you use it, where it goes, how long you keep it, and who can access it.
3. Identify your role. Decide whether you are a controller, joint controller, or processor for each activity.
4. Choose a lawful basis. Document the applicable basis before processing, rather than treating consent as the default for everything.
5. Write accurate privacy information. Give people the information required by Articles 13 or 14 in clear language at the right time.
6. Review cookies and tracking. Separate strictly necessary technology from analytics and advertising, and apply the relevant national ePrivacy rules as well as GDPR standards.
7. Put processor contracts in place. Verify vendors and include the Article 28 terms when a supplier processes personal data for you.
8. Handle international transfers. Identify data leaving the EEA and document the applicable transfer mechanism and safeguards.
9. Create a rights workflow. Be able to recognize, verify, route, and answer a request within the GDPR time limit.
10. Secure the data. Use controls appropriate to the risks, test backups and access, and prepare for breach assessment and notification.
11. Check special triggers. Assess whether you need a data protection impact assessment, data protection officer, EU representative, or more detailed records.
12. Keep evidence and review it. Store decisions, notices, contracts, tests, requests, incidents, and review dates together.

PolicyForge's GDPR compliance tool can help organize this work. A tool can structure evidence and drafts, but it cannot determine every legal issue without the facts of the business.

Does GDPR apply to a small business?

Article 3 of the GDPR provides the core territorial rules. A small business is commonly within scope when:

• It processes personal data in the context of an establishment in the EU, even if some processing happens elsewhere.
• It is outside the EU but offers goods or services to people who are in the EU.
• It is outside the EU but monitors the behavior of people in the EU, such as qualifying online tracking or profiling related to behavior there.

A US shop that simply has a globally accessible English language website is not automatically in scope on that fact alone. A US shop that deliberately targets customers in several EU countries, quotes prices or shipping for those markets, and fulfills orders there is more likely to meet the offering test. A software company that profiles EU users across sites for behavioral advertising may meet the monitoring test.

Scope should be assessed activity by activity. Record the markets targeted, customer locations, currencies, delivery options, languages, campaigns, tracking practices, and the role of any EU establishment. For a plain language introduction to the law and key terms, see What is GDPR?

Are small businesses exempt from GDPR?

There is no general GDPR exemption for a business merely because it has few employees or low revenue. There are narrower rules that can reduce particular obligations.

The Article 30 records exception is limited

Article 30 requires controllers and processors to maintain specified records of processing activities. Article 30(5) creates a limited exception for an organization with fewer than 250 employees. That exception does not apply when the processing is likely to result in a risk to people's rights and freedoms, is not occasional, or includes special category data or personal data relating to criminal convictions and offences.

Routine customer management, payroll, user accounts, recurring marketing, and ongoing analytics will often be non occasional. A concise data inventory is useful even when the formal Article 30 record exception applies, because it supports notices, contracts, retention, security, and rights handling.

A small business does not automatically need a DPO

Article 37 bases the duty to appoint a data protection officer on the organization's status and core activities, not a simple company size threshold. A private business generally must appoint a DPO when its core activities require regular and systematic monitoring of people on a large scale, or large scale processing of special category or criminal offence data. National law can add requirements.

A business can appoint a DPO voluntarily, but should not use the protected DPO title casually. If the mandatory test is not met, assign a privacy owner with clear responsibility and access to management. The EDPB's SME guidance on DPOs gives a practical overview.

Step 1: map personal data and business roles

Start with real systems and workflows, not a generic policy. Personal data includes information relating to an identified or identifiable person. Names and email addresses are obvious examples, but identifiers, location data, device information, account activity, support messages, photos, and combinations of data can also qualify. Our personal data guide explains the concept with examples.

For each activity, record:

• The purpose and owner of the activity.
• The people and data categories involved.
• The source, systems, recipients, processors, and storage locations.
• The lawful basis and any additional condition for special category data.
• The retention rule and deletion method.
• The security controls and any international transfer.

Then determine the role. A controller decides why and how personal data is processed. A processor acts on a controller's documented instructions. A business can be a controller for employee and customer records while acting as a processor for data handled through a client service. Use the controller versus processor guide to document the difference before reviewing contracts and notices.

Step 2: document a lawful basis

Article 6 provides six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Consent is only one option. The correct basis depends on the specific purpose and relationship.

• Contract may support processing objectively necessary to provide a service requested by the person. It does not cover every activity mentioned somewhere in terms.
• Legal obligation may cover processing required by applicable law, such as certain tax or employment records.
• Legitimate interests requires a real interest, necessity, and a balancing assessment against the person's interests, rights, and freedoms.
• Consent must be freely given, specific, informed, and unambiguous, with a genuine ability to withdraw as easily as it was given.

Do not switch bases after the fact merely because the original choice is inconvenient. If processing special category data, also identify an applicable Article 9 condition. The EDPB lawful processing guide provides small business examples.

Step 3: give clear privacy information

Articles 12 to 14 require concise, transparent, intelligible, and easily accessible information. Depending on how the data was obtained, the notice commonly needs to explain the controller's identity and contact details, purposes, lawful bases, legitimate interests where used, recipients, transfers, retention, rights, complaint route, whether providing data is required, and relevant automated decision making information.

A privacy policy should reflect the actual data map. It is not a substitute for the other controls in this guide. Place notices where people need them, such as account creation, checkout, lead forms, applicant workflows, and connected devices. If data comes from another source, review the Article 14 timing and exceptions.

Use the privacy policy generator to create a structured first draft, then compare it with the live systems and contracts. The privacy policy examples show how common sections are expressed, but copying another company's notice will rarely describe your own processing accurately.

Step 4: handle cookies and tracking separately

Cookie compliance is not governed by the GDPR alone. Rules on storing information on, or accessing information from, a user's device generally come from the ePrivacy framework as implemented in national law. GDPR standards apply when consent is the legal basis and when personal data is processed.

A defensible workflow is to:

1. Scan the site and verify what actually loads before and after a choice.
2. Classify technologies by purpose and identify which are strictly necessary under the applicable law.
3. Block non essential technologies when prior consent is required.
4. Offer a real reject option and avoid preselected categories.
5. Make withdrawal as easy as giving consent.
6. Store consent evidence and review it when vendors or purposes change.

Use the cookie scanner to inventory site technologies and the cookie consent banner to implement choices. Configuration still needs to match the applicable country rules and the site's actual tags. The EDPB's consent guidance explains the GDPR standard for valid consent.

Step 5: control vendors and international transfers

Small businesses often rely on hosting, payment, email, analytics, payroll, support, and AI vendors. When a vendor processes personal data on the business's behalf, Article 28 requires a contract containing specified terms. Before signing, check the vendor's instructions, confidentiality, security, subprocessors, assistance, deletion or return, audit information, breach process, and transfer arrangements.

Do not stop at a list of vendor names. Record which data each vendor receives, the purpose, location, subprocessor chain, retention, and the evidence supporting the decision.

When personal data is transferred outside the EEA, identify the Chapter V mechanism. This may be an adequacy decision or an appropriate safeguard such as standard contractual clauses, depending on the facts. Additional assessment or measures may be needed. The European Commission's transfer guidance summarizes the available routes.

Step 6: build a rights request workflow

People may have rights of access, rectification, erasure, restriction, portability, objection, and rights related to qualifying automated decision making. Not every right applies in every circumstance, and exemptions can be relevant.

Under Article 12, respond without undue delay and in any event within one month of receiving a request. The period can be extended by two further months when necessary, taking account of complexity and number of requests, but the person must be informed within the first month and told why. Reasonable identity verification can be appropriate when there are doubts, but do not collect unnecessary identity data.

Train anyone who receives email, chat, or support messages to recognize a request. Keep a request log, assign owners, search all relevant systems, review third party data and exemptions, send securely, and document the response. The EDPB rights guide for SMEs provides a useful overview.

Step 7: secure data and prepare for breaches

Article 32 requires technical and organizational measures appropriate to the risk. A small business is not expected to copy a multinational security program, but it should make deliberate decisions based on the sensitivity, volume, access, threat, and impact of the data it holds.

Common foundations include multifactor authentication, least privilege access, prompt account removal, supported software, encryption where appropriate, tested backups, device controls, logging, vendor review, staff training, and a documented incident process. The EDPB security guide groups practical measures by risk.

When a personal data breach occurs, document the facts, effects, and response. Article 33 generally requires notifying the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware, unless the breach is unlikely to result in a risk to people's rights and freedoms. Article 34 can require communication to affected people when the breach is likely to result in a high risk, subject to its conditions and exceptions.

When does a small business need extra measures?

Data protection impact assessment

Article 35 requires a DPIA before processing that is likely to result in a high risk to people's rights and freedoms. Large scale sensitive data, systematic monitoring of publicly accessible areas on a large scale, and systematic and extensive evaluation with significant effects are listed examples. Supervisory authority lists and guidance add detail. Conduct the assessment early enough to change the design.

EU representative

A controller or processor outside the EU that falls within Article 3(2) may need to designate an EU representative under Article 27. The limited exception depends on the processing being occasional, not including large scale special category or criminal offence data, and being unlikely to result in a risk, taking account of its nature, context, scope, and purposes. This is not a blanket small company exemption.

Automated decisions and profiling

If the business uses automated processing to make decisions that produce legal or similarly significant effects, review Article 22 and related transparency, fairness, and safeguard requirements. Do not assume that adding a nominal human click makes a decision meaningfully human.

A practical 30 day implementation plan

Period	Priority work	Evidence to keep
Days 1 to 5	Confirm scope, assign an owner, inventory systems and vendors, and stop any clearly unnecessary collection.	Scope note, system list, vendor list, data map, and action log.
Days 6 to 12	Document roles, purposes, lawful bases, retention, sensitive data, and transfer mechanisms.	Processing record, legitimate interests assessments where used, retention rules, and transfer records.
Days 13 to 20	Correct privacy notices, cookie behavior, consent flows, forms, and processor contracts.	Versioned notices, scan results, consent tests, signed terms, and vendor review notes.
Days 21 to 30	Test rights and breach workflows, close high risk security gaps, and assess DPO, DPIA, and representative triggers.	Exercise results, incident procedure, security decisions, trigger assessments, and next review date.

For a deeper audit sequence and implementation walkthrough, continue with the practical GDPR compliance guide for small businesses. This page answers the scope, exemption, and checklist questions. The detailed guide is intended for teams carrying out the work.

What penalties can apply?

Article 83 provides different maximum administrative fine tiers. Depending on the breached provision, the maximum can be up to EUR 10 million or 2 percent of worldwide annual turnover, or up to EUR 20 million or 4 percent of worldwide annual turnover, whichever applicable maximum is higher. These are statutory ceilings, not typical prices for a small business violation.

Supervisory authorities must consider factors such as the nature, gravity, duration, intent, mitigation, responsibility, cooperation, data categories, notification, history, and other circumstances. Authorities also have corrective powers beyond fines. Compliance work should be prioritized by risk to people and the business's actual processing, not by unsupported claims about an average SME fine.

Frequently asked questions

Does GDPR apply to a one person business?

It can. GDPR scope is not based on having a minimum number of employees. A sole trader can be a controller or processor and may be within territorial scope. The obligations should be applied proportionately to the processing and risk.

Does GDPR apply to a small business in the United States?

It can apply when the business offers goods or services to people in the EU or monitors their behavior there. A website being technically accessible from the EU is not enough by itself. Review targeting, sales, tracking, and other evidence.

Is a small business exempt if it has fewer than 250 employees?

No. The employee threshold appears in a limited Article 30 record keeping exception, and that exception has important conditions. It does not remove the rest of the GDPR.

Does every small business need a privacy policy?

A business within scope must provide the required privacy information to people. A website privacy notice is a common way to do that for online processing, but other just in time or audience specific notices may also be needed. The content must match the business's actual practices.

Does every website need a cookie banner?

No single answer covers every website and country. The result depends on which technologies are used, whether they are strictly necessary, and the applicable national ePrivacy rules. Scan and test the site before choosing a banner configuration.

How long does a business have to answer a GDPR request?

The standard deadline is without undue delay and within one month. A qualifying extension can add two months, but the person must be told within the first month and given the reasons.

Can a small business use consent for all processing?

Consent is not the universal or safest basis. It must be freely given and withdrawable. Choose and document the basis that fits each purpose, and meet any extra conditions for special category data.

Start with a defensible record

The most useful first step is to build one accurate record of data, purposes, roles, vendors, retention, transfers, and risks. From that record, the business can correct its notices, contracts, controls, and request workflows without guessing.

Use the PolicyForge GDPR compliance tool to organize the assessment and action list. Review outputs against the current GDPR text, EDPB and supervisory authority guidance, the live systems, and qualified professional advice where the risk or facts require it.